A flaw in Wallos allows an authenticated user to store an internal or private IP address as a webhook notification URL. The validate_webhook_url_for_ssrf() protection was added only to test endpoints and not to the save endpoints, so when the scheduled sendnotifications.php task runs it resolves the webhook URL without SSRF validation. This omission lets the application make HTTP requests to any internal IP, potentially exposing internal services, retrieving sensitive data, or facilitating lateral movement within the network. The weakness is categorized as an SSRF vulnerability (CWE-918).

The vulnerability exists in all releases of Ellite Wallos prior to version 4.7.0. Administrators using any earlier build should be aware that the system can accept and forward requests to internal or private addresses configured as notification URLs.

The CVSS score of 7.7 indicates a high risk, and the EPSS score of less than 1% suggests low current exploitation prevalence. The issue is not listed in CISA’s KEV catalog. The attack vector requires authentication to the application and the ability to save a webhook URL; once the cron job runs the malicious request is executed automatically. While the impact is limited to internal network resources, the potential for further exploitation depends on the services exposed on those internal IP addresses.